topic Re: Cavecreek chipset failing encryption/Decryption in Embedded Intel® Core™ Processors

Cavecreek chipset failing encryption/Decryption

MYada — Wed, 29 Mar 2017 04:24:39 GMT

We are using Intel Cavecreek chipset of Encryption/Decryption of IPSec data traffic.Of late we have face some issues where either some Encryption/decryption is wrong or altogether all operation where chipset if required fails... For such types of issues, we want to know is there any debug facility/utilitiy which can be used to narrow down the issue root-cause...

To add details, we are are taking about two different issues.

In both cases, we have chassis. Where each card handling traffic is attached with Cavecreek DH89XXc series chipset.

Driver interacts with chipset for encryption/decryption related functionalities. It is layer 3 IPSec solution.

This issues are seen on production sites, where we have very limited access to debugibility.

Problem mentioned below are seen on multiple chassis nodes and multiple times.

Each time problem is resolved with reboot of Hardware.

Issue1:

Here we have multiple SA. While encryption we gave plain packet to chipset and encrypted packet is forwarded to n/w. When issue arises, we see that post decryption first 12 bytes are wrong. Out of these 12 bytes, initial 8 bytes are prepended with some junk and rest 4 bytes overwitten..

Ex. Plain packet was

01 02 03 04 05 06 07 08 ......

If SPI of SA was 0A0B0C0D

Post decryption what we get is

_ _ _ _ _ _ _ _ X X X X 05 06 07 08 ........

Note: As such all works fine and this solution is long deployed and widely used.

Once this issue happens. Even if we deleted SA and install fresh SA. Same issue persists.

Until we do hard reset of card.

Constant 12 bytes corruption is pointing to us some memory corruption in chipset. Because if there is logic problem/memory corruption in application driver. It shall go away with Application restart or SA deletion.

This problem once triggered don't go until card reset is done which leads to chipset reset as well.

Issue2:

Our solution use Cavecreek chipset for various scenario:

1. Dh Group data calculation

2. Encryption/Decryption SA

3. Seqno retrival for particular SA.

We have seen some instance of reporting issue from production site, that on some card, all of sudden all process as mentioned above which involved interaction with Chipset stops working and start returning error code.

Ex: cpaCyDhKeyGenPhase1 returns -2 which is CPA_STATUS_RETRY.

This problem also gets resolved with hard reset of card.

Both this issues points some corruption at chipset level whic gets resolved by re-initialisation of chipset.

Wanted to know whether such issues for cavecreek chipset are already reported.

and if yes, what can be trigger for this scenario.

Re: Cavecreek chipset failing encryption/Decryption

CarlosAM_INTEL — Wed, 29 Mar 2017 14:36:37 GMT

Hello, Mukesh:

Thank you for contacting Intel Embedded Community.

In order to be on the same page, could you please confirm if the affected design has been developed by you or a third party company? If it is a third party design, please give us all the information related to it.

In case that it has been designed by you, could you please tell us the part numbers of the processors related to the affected project?

Please let us know this information to have a better idea of this condition and find the information that may help you.

Best regards,

Carlos_A.

Re: Cavecreek chipset failing encryption/Decryption

MYada — Wed, 29 Mar 2017 14:57:58 GMT

In this design, we have a kernel driver which interacts with ucam driver and then comes chipset which is for varios functionalities like Encryption/Decryption/DH Group Calculation etc.

Version file of cavecreek package has following info:

PACKAGE_TYPE=DH89xxCC

PACKAGE_OS=L

PACKAGE_VERSION_MAJOR_NUMBER=0

PACKAGE_VERSION_MINOR_NUMBER=9

PACKAGE_VERSION_PATCH_NUMBER=0

PACKAGE_VERSION_BUILD_NUMBER=162

Let me know if what part number you looking for

Re: Cavecreek chipset failing encryption/Decryption

CarlosAM_INTEL — Wed, 29 Mar 2017 18:43:54 GMT

Hello, Mukesh:

We appreciate your reply.

Please let me paraphrase part of my previous questions:

Could you please give us a block diagram of the affected project like the one showed at the following website with the part numbers of all the devices that you have used to implement it?

http://www.intel.com/content/dam/www/program/embedded/interactive-block-diagrams/us/en/navy-pier/atom-n270-ibd_small_v2.png http://www.intel.com/content/dam/www/program/embedded/interactive-block-diagrams/us/en/navy-pier/atom-n270-ibd_small_v2.…

Thanks in advance for your cooperation.

Best regards,

Carlos_A.

Re: Cavecreek chipset failing encryption/Decryption

MYada — Thu, 30 Mar 2017 16:51:18 GMT

Hi Carlos,

Please refer

Figure 1 & 2

https://01.org/sites/default/files/page/comms_8900_8920_sw_pg_rev_006.pdf https://01.org/sites/default/files/page/comms_8900_8920_sw_pg_rev_006.pdf

Re: Cavecreek chipset failing encryption/Decryption

MYada — Fri, 31 Mar 2017 08:50:57 GMT

Some Additional info

lspci -d 8086:0434

06:00.0 Co-processor: Intel Corporation DH89XXCC Series QAT

CPU is Chipset: 5520-IOH C2, ICH10R A0, 96 GB

Cavecreek chipset attached is 8900 Series..

Re: Cavecreek chipset failing encryption/Decryption

MYada — Fri, 31 Mar 2017 11:40:55 GMT

Based on further O/p.

od -x /sys/bus/pci/devices/0000:06:00.0/config | head -1 | awk '{print $6}'

0021

This is C1 type chipset as per Section 2.2

https://01.org/sites/default/files/page/comms_8900_8920_sw_pg_rev_006.pdf https://01.org/sites/default/files/page/comms_8900_8920_sw_pg_rev_006.pdf

Re: Cavecreek chipset failing encryption/Decryption

MYada — Fri, 31 Mar 2017 15:26:44 GMT

This info might also help

CPU, Westmere, Intel part number AT80614003591AB SLBWY, Cisco PN 15-12954-01

Cave Creek, Intel part number DH8920CC 923817 SLIVX, Cisco PN 15-14055-01

Re: Cavecreek chipset failing encryption/Decryption

CarlosAM_INTEL — Wed, 05 Apr 2017 19:03:16 GMT

Hello, Mukesh:

Thanks for your replies.

In order to help you, we will contact you via email.

Best regards,

Carlos_A.